STIGQter STIGQter: STIG Summary: MongoDB Enterprise Advanced 8.x Security Technical Implementation Guide Version: 1 Release: 1 Benchmark Date: 26 Jan 2026:

MongoDB must prohibit user installation of logic modules (stored procedures, functions, triggers, views, etc.) without explicit privileged status.

DISA Rule

SV-279380r1179481_rule

Vulnerability Number

V-279380

Group Title

SRG-APP-000378-DB-000365

Rule Version

MD8X-00-007300

Severity

CAT II

CCI(s)

Weight

10

Fix Recommendation

Revoke unapproved roles from nonadministrative users as per the site-specific document by executing db.revokeRolesFromUser for each user and database:

> use <database>
> db.revokeRolesFromUser( "<username>", [ <roles> ], { <writeConcern> } )

Reference:
https://www.mongodb.com/docs/v8.0/reference/method/db.revokeRolesFromUser/

Edit the MongoDB configuration file (default location: /etc/mongod.conf) to include the following:

security:
javascriptEnabled: false

Check Contents

If MongoDB supports only software development, experimentation and/or developer-level testing (that is, excluding production systems, integration testing, stress testing, and user acceptance testing), this is not a finding.

MongoDB can control nonadministrative users' ability to create, alter, or replace logic modules by defining specific roles and permissions. While MongoDB does not directly support stored procedures, functions, triggers, and views in the way relational databases do, similar functionalities can be implemented using various features.

An organizational or site-specific document should exist and be reviewed to determine what built-in MongoDB roles and associated privileges may be considered authorized and what users are administrative users.

For each database, run the following commands in MongoDB as an administrative user to determine what users and roles they are assigned:

> use <database>
> db.getUsers()

For any nonadministrative user in a database, check if any roles are not compliant with the site-specific documentation for users. If any user in any database is found to have a role that is not allowed, this is a finding.

MongoDB allows users to store JavaScript functions on the server. Javascript should be disabled for all users.

Review the Mongodb configuration file (default location /etc/mongod.conf) and ensure the following is set to disable JavaScript:

security:
javascriptEnabled: false

If this is not set in the MongoDB configuration file, this is a finding.

Vulnerability Number

V-279380

Documentable

False

Rule Version

MD8X-00-007300

Severity Override Guidance

If MongoDB supports only software development, experimentation and/or developer-level testing (that is, excluding production systems, integration testing, stress testing, and user acceptance testing), this is not a finding.

MongoDB can control nonadministrative users' ability to create, alter, or replace logic modules by defining specific roles and permissions. While MongoDB does not directly support stored procedures, functions, triggers, and views in the way relational databases do, similar functionalities can be implemented using various features.

An organizational or site-specific document should exist and be reviewed to determine what built-in MongoDB roles and associated privileges may be considered authorized and what users are administrative users.

For each database, run the following commands in MongoDB as an administrative user to determine what users and roles they are assigned:

> use <database>
> db.getUsers()

For any nonadministrative user in a database, check if any roles are not compliant with the site-specific documentation for users. If any user in any database is found to have a role that is not allowed, this is a finding.

MongoDB allows users to store JavaScript functions on the server. Javascript should be disabled for all users.

Review the Mongodb configuration file (default location /etc/mongod.conf) and ensure the following is set to disable JavaScript:

security:
javascriptEnabled: false

If this is not set in the MongoDB configuration file, this is a finding.

Check Content Reference

M

Target Key

5728